3 ms·

It wouldn't be infeasible for the intelligence services to require Intel to pre-install a keylogger into the ME of every unit sold to the public. Should we assu

It wouldn't be infeasible for the intelligence services to require Intel to pre-install a keylogger into the ME of every unit sold to the public. Should we assume adequate precautions on your part?

johnchristopher 5y ago
Can you prove every device is intentionally compromised out of the factory ? "extraordinary claims require extraordinary evidence"
- GhettoComputers 5y ago
  Never heard of it? On x86 he’s not wrong, Intel ME and AMD ST are enabled in mobo and Intel ME run another secret minix OS that bypasses all your security. https://en.m.wikipedia.org/wiki/Intel_Management_Engine https://en.m.wikipedia.org/wiki/Intel_Management_Engine >The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power. >The Intel ME is an attractive target for hackers, since it has top level access to all devices and completely bypasses the operating system. The Electronic Frontier Foundation has voiced concern about Intel ME and some security researchers have voiced concern that it is a backdoor. > Intel's main competitor AMD has incorporated the equivalent AMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs. You can buy boards with it disabled, some Dell devices have the option to disable it, some flashing can be done on mobos to clear ME unofficially, but assume everything has it unless you only otherwise.
  - johnchristopher 5y ago
    Oh, yes ! I remember about that now ! It changes the scope from "access to device = no security" to "access to device by NSA people with a very specific set of skills and most likely some prep work = no security" and I won't fight it, it's right. Not possible for the random HN user though and it still means some very specific circumstances. Circumstances that need someone to compromise my laptop at some point after it got out of the factory. From reading the Wikipedia article it's not clear ME leaves a backdoor or store user passwords or keys somewhere on the computer in case an NSA agent needs to access data. I think my encrypted devices are safe, unless the NSA or a nation state wants its data.
    - GhettoComputers 5y ago
      It can be easily hacked, because it has privileged access and is also used by IT for remote control. https://www.intel.com/content/www/us/en/support/articles/000035669/technologies.html https://www.intel.com/content/www/us/en/support/articles/000...
      - johnchristopher 5y ago
        Hmm. Seems you need to enable ME in my laptop BIOS. Can it be easily done if the BIOS is locked down ? And then what's the next step ? You start the laptop, give it an IP through MAC address on the router or direct Ethernet link, connect to ME but how do you get to the data off of the encrypted partition/OS ?

It wouldn't be infeasible for the intelligence services to require Intel to pre-install a keylogger into the ME of every unit sold to the public. Should we assume adequate precautions on your part?

johnchristopher 5y ago

Can you prove every device is intentionally compromised out of the factory ? "extraordinary claims require extraordinary evidence"

GhettoComputers 5y ago
Never heard of it? On x86 he’s not wrong, Intel ME and AMD ST are enabled in mobo and Intel ME run another secret minix OS that bypasses all your security. https://en.m.wikipedia.org/wiki/Intel_Management_Engine https://en.m.wikipedia.org/wiki/Intel_Management_Engine >The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power. >The Intel ME is an attractive target for hackers, since it has top level access to all devices and completely bypasses the operating system. The Electronic Frontier Foundation has voiced concern about Intel ME and some security researchers have voiced concern that it is a backdoor. > Intel's main competitor AMD has incorporated the equivalent AMD Secure Technology (formally called Platform Security Processor) in virtually all of its post-2013 CPUs. You can buy boards with it disabled, some Dell devices have the option to disable it, some flashing can be done on mobos to clear ME unofficially, but assume everything has it unless you only otherwise.
- johnchristopher 5y ago
  Oh, yes ! I remember about that now ! It changes the scope from "access to device = no security" to "access to device by NSA people with a very specific set of skills and most likely some prep work = no security" and I won't fight it, it's right. Not possible for the random HN user though and it still means some very specific circumstances. Circumstances that need someone to compromise my laptop at some point after it got out of the factory. From reading the Wikipedia article it's not clear ME leaves a backdoor or store user passwords or keys somewhere on the computer in case an NSA agent needs to access data. I think my encrypted devices are safe, unless the NSA or a nation state wants its data.
  - GhettoComputers 5y ago
    It can be easily hacked, because it has privileged access and is also used by IT for remote control. https://www.intel.com/content/www/us/en/support/articles/000035669/technologies.html https://www.intel.com/content/www/us/en/support/articles/000...
    - johnchristopher 5y ago
      Hmm. Seems you need to enable ME in my laptop BIOS. Can it be easily done if the BIOS is locked down ? And then what's the next step ? You start the laptop, give it an IP through MAC address on the router or direct Ethernet link, connect to ME but how do you get to the data off of the encrypted partition/OS ?